Legal

Privacy policy

What we collect when you join the waitlist, who handles it, and how to ask us to change or delete it.

Last updated 30 September 2026

Draft

This is a plain-English draft. It describes what the site does today and it has not been through legal review.

In plain words

  • When you join the waitlist we save your email address. It is the only detail you must give. Your handle and your event are optional. Section 2
  • We use your details to tell you when things open. You get one welcome email, and the people who run Stick On Me get an alert about your signup. Section 5
  • We do not share your data with advertisers, and we do not use advertising cookies or advertising trackers. Section 4
  • We keep your entry until you ask us to delete it or we shut the list down. Section 9
  • Every email has an unsubscribe link. To see, correct or delete what we hold, write to [email protected]. Section 10

The sections below give the full wording.

1. The short version

Stick On Me is a waitlist today. You give us an email address and a few optional details, and we use them to tell you when things open. We do not run advertising cookies and we do not sell your data. You can ask us to show you, correct or delete what we hold by writing to [email protected].

This policy covers the Stick On Me website at stickonme.com and the emails we send from it. No one can pay for anything on the site yet, so we hold no payment details, no passwords and no accounts.

2. What we collect when you join the waitlist

Each time you submit a waitlist form we save one row in our database. It holds the following.

From the form you fill in

  • Your email address. This is the only detail you must give.
  • Your role. This is either Athlete or Brand, depending on the form you used.
  • Your social handle or website, if you enter one. If you paste a profile link, we keep the handle from it and record which platform it belongs to (for example Instagram, X, TikTok, Threads, YouTube, LinkedIn or Strava). If you enter a website address, we keep that address and record the platform as web.
  • Your race or other event, if you enter one, including its date if you type it in.
  • The surfaces you picked. These are body, laptop, shirt or other, depending on the form. Some forms set this for you.

Recorded when you submit

  • Where you came from. This is the page you signed up on and the address of the page that sent you to us, when your browser shares it.
  • The query string of the address you signed up from. This is the part after the question mark, which often holds campaign tags such as UTM tags.

  • A one-way hash of your IP address. We combine your IP address with a secret salt and store the resulting value. We do not store the IP address itself in our database.

    The same connection always produces the same value, so the hash can show that two entries came from one connection. We use it to limit abuse and it is not designed to identify you.

  • A shortened browser description. This is the first 200 characters of your browser's user agent, which usually names your browser and device type.
  • When you signed up, and the position number we show you.

Sending a repeat signup with the same email and role does not create a second row. We show you your existing position instead.

We also make a running total of signups available to the site so it can show how many people have joined. That total contains no personal details.

3. Rate limits and race card taps

Rate limiting. To stop automated abuse we allow five signups per connection per minute. To do that we keep a small table with the hashed IP value, the minute, and a count of attempts.

Race card tap log. The page sends a short message to us when you do any of the following.

  • Tap a race card button.
  • Follow an outbound link from a race card.
  • Tap the show all races control.
  • Submit a waitlist form.

For each message we record the following.

  • The event name.
  • The race.
  • The series. For a waitlist submission this holds your role.
  • The country your connection appears to come from, as reported by Cloudflare.
  • The same kind of hashed IP value.
  • The time.

The log has no email address in it. We use these logs to see which races people are interested in and to keep the site working.

4. Visit statistics and fonts

We use Cloudflare Web Analytics to count visits. It is cookieless, so it does not set cookies in your browser. It gives us totals such as pages viewed, referring sites, countries and device types.

The site loads its typeface from Google Fonts. When a page loads, your browser asks Google's servers for the font files, so Google receives your IP address and browser details in the normal way for any web request.

We do not use advertising cookies or advertising trackers.

5. Emails and unsubscribing

Welcome email. When you join for the first time we send you one welcome email. It includes your position number and an unsubscribe link. We send it through Resend.

Alerts to us. Each new signup also sends an alert email to the people who run Stick On Me. It carries your role, position, email address, handle and platform, the race or event you entered, the page source and the query string.

Unsubscribing. Every email has an unsubscribe link, and some mail apps show a one-click unsubscribe button. When you unsubscribe we store the time of the request against your entry. Your address stays in the database so that we do not add you again by mistake. If you want the entry removed completely, ask us and we will delete it.

Writing to us. Mail sent to [email protected] passes through Cloudflare Email Routing and reaches the inboxes of the people who run Stick On Me. Replies to our emails come to the same address.

6. What stays in your browser

After you join, the page saves a small entry named som_wl in your browser's local storage. It holds your email address, your position and your role. It stays on your device and the site does not send it to us. You can remove it by clearing this site's data in your browser settings.

7. Services that handle your data

  • Cloudflare hosts the site (Pages), runs the code that receives signups (a Worker), stores the waitlist and logs (a D1 database), routes mail sent to our address (Email Routing) and provides cookieless Web Analytics.
  • Resend sends the welcome emails and the alert emails.
  • Google Fonts serves the site's typeface, as described above.

These services process data for us under their own terms and privacy policies. We do not sell your data and we do not share it with advertisers. The people who run Stick On Me can also export the waitlist to work with it, for example to send launch news.

8. Where your data is stored

People in several countries use this site, and the services above may handle data in different places. Waitlist data is stored with Cloudflare, so it may be held outside the country where you live.

9. How long we keep it

We keep waitlist entries and logs until you ask us to delete them or we shut the list down.

10. Your rights

You can ask us at any time to do any of the following.

  • Tell you what we hold about you and give you a copy.
  • Correct anything that is wrong.
  • Delete your entry.
  • Stop emailing you. The unsubscribe link does this straight away.

Write to [email protected] from the address you signed up with. We respect the rights that data protection laws around the world describe, and we will answer your request as promptly as we can.

Copies of welcome and alert emails may also sit in email accounts and in the records of the email services above, and we will remove the ones we control.

11. Changes to this policy

We will update this policy as the site changes, for example when accounts and payments arrive. We change the date at the top when we do. If we start collecting new kinds of data, we will update this page before we do.

12. Contact

Write to [email protected] with any question about your data.

Back to contents